KTH Student Discovers Critical Security Flaws in Children's Smartwatch
By
jidoka
Crusty in the right places. Worth the chew.
Summary
A KTH student discovered serious security vulnerabilities in a children's smartwatch during his thesis work. The watch had an insecure network service accessible via the internet, allowing attackers to take complete control, access all functions including camera and microphone, track location, and communicate with the child. The student reported the vulnerabilities to the manufacturer, who acknowledged the issues but hasn't fixed them yet. The research highlights significant privacy and security risks in IoT devices marketed for children.
Key quotes
· 4 pulledAs an attacker, you can then take complete control of the watch and use everything it has. There are lots of functions that can be abused.
You can take pictures with the camera, listen with the microphone, track the child's location, and communicate with the child.
The manufacturer has acknowledged the vulnerabilities but has not yet fixed them.
The watch had an insecure network service that anyone could access via the internet.
You might also wanna read
#NYTechWeek Panel: Addressing the Youth Cybersecurity Talent Gap
This article announces a panel event at #NYTechWeek focused on the cybersecurity talent gap among young people. Moderated by Girls Who Code
partiful.com·8h ago
Building a Vulnerable SSH Lab to Learn Real-World Attack Techniques
This article guides readers through setting up and using VulnSSH, a purposely insecure SSH environment inside a local pentest lab, to learn
infosecwriteups.com·1d ago
Higher Education Grapples with Cybersecurity Fallout After Canvas LMS Ransomware Attack
A ransomware attack on Instructure's Canvas LMS has sparked widespread concern in higher education about cybersecurity, data privacy, and th
er.educause.edu·2d ago
CoSN Report: Cybersecurity Tops EdTech Priorities, But Staffing and Budget Gaps Persist
CoSN's annual State of EdTech Leadership Report reveals cybersecurity as the top priority for K-12 education technology leaders. While most
cosn.org·4d ago
Shira: A Phishing Awareness Training Platform for Teams and Individuals
Shira is a cybersecurity training platform that helps organizations and individuals build skills to identify and defeat phishing attacks. It
shira.app·10d ago
Canvas parent company reaches deal with hackers to delete stolen student data
Instructure, the parent company of the Canvas online learning platform, reached an agreement with hackers to delete data stolen in a cyberat
nbcnews.com·17d ago